Commitd9db473

committed

fix: ensure reserved events cannot be used as event names

1 parent6a5a004 commitd9db473Copy full SHA for d9db473

File tree

+17

-1

lines changed

+17

-1

lines changed

Lines changed: 15 additions & 1 deletion

Original file line number	Diff line number	Diff line change
`@@ -5,6 +5,18 @@ import debugModule from "debug"; // debug()`
`5`	`5`
`6`	`6`	`constdebug=debugModule("socket.io-parser");// debug()`
`7`	`7`
	`8`	`+/**`
	`9`	`+ * These strings must not be used as event names, as they have a special meaning.`
	`10`	`+ */`
	`11`	`+constRESERVED_EVENTS=[`
	`12`	`+"connect",// used on the client side`
	`13`	`+"connect_error",// used on the client side`
	`14`	`+"disconnect",// used on both sides`
	`15`	`+"disconnecting",// used on the server side`
	`16`	`+"newListener",// used by the Node.js EventEmitter`
	`17`	`+"removeListener",// used by the Node.js EventEmitter`
	`18`	`+];`
	`19`	`+`
`8`	`20`	`/**`
`9`	`21`	`* Protocol version.`
`10`	`22`	`*`
`@@ -277,7 +289,9 @@ export class Decoder extends Emitter<{}, {}, DecoderReservedEvents> {`
`277`	`289`	`casePacketType.BINARY_EVENT:`
`278`	`290`	`return(`
`279`	`291`	`Array.isArray(payload)&&`
`280`		`-(typeofpayload[0]==="string"\|\|typeofpayload[0]==="number")`
	`292`	`+(typeofpayload[0]==="number"\|\|`
	`293`	`+(typeofpayload[0]==="string"&&`
	`294`	`+RESERVED_EVENTS.indexOf(payload[0])===-1))`
`281`	`295`	`);`
`282`	`296`	`casePacketType.ACK:`
`283`	`297`	`casePacketType.BINARY_ACK:`

Lines changed: 2 additions & 0 deletions

Original file line number	Diff line number	Diff line change
`@@ -121,6 +121,8 @@ describe("socket.io-parser", () => {`
`121`	`121`	`isInvalidPayload('2[{"toString":"foo"}]');`
`122`	`122`	`isInvalidPayload('2[true,"foo"]');`
`123`	`123`	`isInvalidPayload('2[null,"bar"]');`
	`124`	`+isInvalidPayload('2["connect"]');`
	`125`	`+isInvalidPayload('2["disconnect","123"]');`
`124`	`126`
`125`	`127`	`expect(()=>newDecoder().add("999")).to.throwException(`
`126`	`128`	`/^unknownpackettype9$/`

Comments

(0)